When a device is connected, or a file is imported, you can see the device file system or, the folder and file structure of the import.
This is viewed using our File Manager; more information can be read here.
Content can be browsed with or without installation of the Forensic Connector app, although there is a difference in accessible data; installing the Connector app is best.
You will be shown a pop-up reminder letting you know if the Forensic connector app isn’t installed and asking if you would like to install it.
With the Connector app:
Without the Connector app:
As you can see from the screenshots, you will not have access to the applications and their data without the Connector app. This is due to the additional permissions granted to the app.
Examples of directory names are:
-
Internal (raw0)
-
External (raw3)
-
Multi root (raw4)
-
Applications (applications0)
-
Extra applications (applications1)
To see a description of what the named directories contain, please read the page on the Output folder structure
Device info
Within the Extra applications (applications1) directory, there is commonly a file named “getprop.txt”
This text file contains some very useful information for investigators.
For example:
-
Encryption and Data-Access State
-
Chipset / Hardware Identification
-
Exact Device Identification
-
Android Version, Build and Security Patch
-
Bootloader / Verified Boot / Device Integrity
-
Boot Information
-
SIM, Carrier and Cellular Information
-
Baseband / Modem / Firmware Identification
-
USB / ADB State
-
Locale, Timezone and Regional Configuration
The properties available vary between Android versions, manufacturers and device models. Values may describe permanent device configuration, boot-time configuration or the device's state at the time the properties were collected. Therefore, property names and values should be interpreted in context rather than assumed to be present or equivalent on every device.